Upgrade aws auth, fix CF template bug

flah00 commented 4 years ago

Description

Fix bug in stack-template for controller, around OpenICMP and ssh security groups
Upgrade to aws-iam-authenticator 0.5.1
Resolve issue introduced in 941fd29, where the context cluster name didn't match
Fix formatting issue with controller and worker kubeconfig files
Add clusterrole, binding, and service account
Allow aws-iam-auth to be scheduled on k8s 1.15 and 1.16

Versions

I have successfully created a new stack, on master
I have not tested this on v0.16.x
I have successfully created a new stack, on v0.15.x
- This can be safely merged into v0.15.x after #1874 and #1886

Installing the aws-iam-authenticator

AWS authenticator expects IAM roles for controllers and workers already exist. As it is currently configured, the aws-iam-authenticator must be enabled after the initial kube-aws apply. This is because the exports on the root stack, for workers, are not available to the control plane stack during creation, ie

+00:06:18 CREATE_FAILED test-Controlplane-13Y4STRG1AGDV "No export named test-NodePoolPool1eWorkerIAMRoleArn found"

flah00 commented 4 years ago

Once the aws iam authenticator is enabled, the root stack can no longer be deleted, because the root stack exports a variable the control plane relies on. To delete the root stack you must first delete the control plane.

Export k8s-NodePoolPool1eWorkerIAMRoleArn cannot be deleted as it is in use by k8s-Controlplane-1VKY701ZEUMW4

dominicgunn commented 4 years ago

Hey @flah00,

Thanks again for the work. Could you add a comment about that root stack deletion somewhere appropriate so that it doesn't just exist in this PR?

k8s-ci-robot commented 4 years ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: To complete the pull request process, please assign justinsb You can assign the PR to them by writing /assign @justinsb in a comment when ready.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/kubernetes-incubator/kube-aws/blob/master/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

dominicgunn commented 4 years ago

/approved /lgtm

kubernetes-retired / kube-aws